Database/Kernel, userspace & hypervisor
Linux kernel VFIO drivers/vfio/pci/vfio_pci_intrs.c - MSI/MSI-X allocation: Sibling of CVE-2016-9083 in the same
Impact
Sibling of CVE-2016-9083 in the same MSI/MSI-X setup path - the kzalloc size computation overflows, the kernel allocates a buffer far smaller than the interrupt array it is about to populate, and the heap is corrupted. Same reachability, same consequence: the process holding a tenant's passed-through GPU corrupts host kernel memory. Catalogued separately because the two were fixed in one commit and an operator checking only one CVE ID against a vendor changelog can convince themselves they are patched when they are not.
Who can reach it
Local process with access to a VFIO PCI device file - the tenant's VMM or a container granted /dev/vfio.
What to do
Same fix as CVE-2016-9083 (commit 05692d7005a364add85c6e25a6c4447ce08f913a, RHSA-2017:0386); one kernel upgrade and rolling reboot closes both. Verify by kernel version rather than by CVE ID in a vendor advisory list, since backport changelogs frequently name only one of the pair.
References
Related entries
- Linux kernel (ELF loader): PIE stack buffer corruption, local rootCVE-2017-1000253 · Linux kernel (ELF loader)High
- Linux i915 GPU kernel driver (execbuffer2 ioctl): The execbuffer2 ioctl accepted a userspace-supplied address withoutCVE-2018-20669 · Linux i915 GPU kernel driver (execbuffer2 ioctl)High
- Intel i915 graphics kernel-mode driver for Linux (< 5.0): Insufficient input validation in the i915 kernel-mode driverCVE-2019-11085 · Intel i915 graphics kernel-mode driver for Linux (< 5.0)High
- Linux kernel (ptrace): Broken permission and object lifetime handling for PTRACE_TRACEME, local rootCVE-2019-13272 · Linux kernel (ptrace)High
- AMD Radeon Kernel Mode driver - Escape 0x2000c00 call handler: A low-privileged attacker can drive the RadeonCVE-2020-12964 · AMD Radeon Kernel Mode driver - Escape 0x2000c00 call handlerHigh
- Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2020-7053 · Linux i915 GPU kernel driverHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.